Return to Answer

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier in this case, as the notation for the math on the commitments matches that of the uncommitted values.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the coefficients random) over $GF(p)$; he also creates a Pallier commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a series of NIZKPs that he knows the values $c_i$ that he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_nG + r_nH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier in this case, as the notation for the math on the commitments matches that of the uncommitted values.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the coefficients random) over $GF(p)$; he also creates a Pedersen commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a series of NIZKPs that he knows the values $c_i$ that he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_nG + r_nH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the coefficients random) over $GF(p)$; he also creates a Pallier commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a series of NIZKPs that he knows the values $c_i$ that he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_iG + r_iH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier in this case, as the notation for the math on the commitments matches that of the uncommitted values.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the coefficients random) over $GF(p)$; he also creates a Pallier commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a series of NIZKPs that he knows the values $c_i$ that he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_nG + r_nH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the terms random) over $GF(p)$; he also creates a Pallier commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a NIZKP that he knows the value $c_i$ the he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_iG + r_iH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.

Here is one possible approach:

• The dealer generates a group suitable for a Pedersen commitment scheme (namely, an Elliptic Curve with prime order $p$, and two elements $G, H$ where no one knows the discrete log of $H$ with respect to $G$) - we can do this in a multiplicative group; I just find the additive notation a bit easier.

• The dealer selects a Shamir Secret Sharing polynomial (the constant term the shared secret, the rest of the coefficients random) over $GF(p)$; he also creates a Pallier commitment for each coefficient $c_i$ (using a random value $r_i$), and publishes it (and so he publishes the values $c_iG + r_iH$), along with a series of NIZKPs that he knows the values $c_i$ that he committed to

• The dealer generates shares for each one; with user $x$, he generates the share $z = c_nx^n + c_{n-1}x^{n-1} + … + c_0x^0$ and also generates a NIZPF that $x^n(c_iG + r_iH) + x^{n-1}(c_{n-1}G + r_{n-1}H) + … + x^0(c_0G + r_0H)$ is a commitment to $z$; he sends $z$ and the NIZKP to the user.

Each user can verify (based on the public NIZKPs) that the dealer has committed to a single group-wide polynomial. In addition, based on the NIZKP that the dealer gives to each user, they can verify that their share is consistent with that group-wide polynomial.